How Scammers Choose Their Targets
Most scams are sent to everyone; some are aimed at one person. How mass and targeted scams choose their victims, what makes someone a target, and how to become a harder one.
If you receive a scam message, it is natural to wonder, "Why me?" The answer depends on which kind of scam it is. Most scams are not aimed at you at all; they are aimed at everyone, and you happened to be on the list. A smaller number are carefully aimed at a particular person or business. Understanding the difference tells you how worried to be and how to respond.
Mass scams: a numbers game
Mass scams are sent to huge numbers of people at once: fake delivery texts, prize messages, "your account is locked" emails, crypto investment adverts. The economics are simple. Sending a million messages costs very little, and if only a tiny fraction respond, it pays.
- How victims are chosen: they are not, really. Anyone whose number or email is on a list receives the message. Our guide on how scammers get your phone number and email explains where those lists come from.
- Who responds: people for whom the message happens to fit their situation at that moment, such as someone actually expecting a parcel.
- What it means for you: a mass scam in your inbox says nothing about you personally.
Targeted scams: aimed at you
Targeted scams use research to make a message fit a specific person or organization. They take more effort, so they usually aim for bigger rewards.
- Business email compromise: a fake message from a "supplier" or "CEO" asking for a payment or a change of bank details, timed around real invoices.
- Spear phishing: an email that mentions your role, your colleagues or a real project.
- Impersonation of family: a message from a "child" using details from social media.
- Romance and investment scams: long conversations tailored to the victim's interests, loneliness or ambitions.
What makes someone more likely to be targeted
Being targeted is not a personal failing. These are simply the signals scammers look for:
| Signal | Why scammers care |
|---|---|
| Responding before | A reply or click marks your number or email as active and engaged. |
| Having been scammed already | Past victims are contacted again, often by fake recovery services. |
| Visible life events | Moving house, job hunting, bereavement, retirement, a new business or a large purchase shared online. |
| Public role and contacts | Finance staff, executives, administrators and anyone listed on a company website. |
| Access to money or systems | People who approve payments or hold admin rights are worth more research. |
| Visible loneliness or financial stress | Romance and loan scams look for people who are isolated or under pressure. |
How to become a harder target
For everyone
- Do not engage with scam messages, even to tell them off.
- Share less publicly, especially travel plans, family details and life events, and review who can see your profile. The NCSC's advice on using social media safely is a good checklist.
- Protect key accounts with unique passwords and two-step verification.
- Be extra careful after a scam, when follow-up attempts are most likely. See our guide to recovery scams.
For businesses
- Verify every change of bank details by calling a known number, never one in the email.
- Require two people to approve large or unusual payments.
- Limit what staff directories reveal publicly about roles and reporting lines.
- Train staff with realistic examples and make reporting easy and blame-free.
The most useful mindset: it is not about whether you look like a target. Everyone receives scams. What matters is having rules that stop you acting on unexpected requests without checking.
Received something that seems written just for you? Paste it into CyberWatch AI Scan for a free check, then verify through a channel you trust.
To understand why these messages work even on careful people, see why smart people fall for scams. For every major scam type and how to respond, read the complete guide to online scams.
Frequently asked questions
Why do I get so many scam messages?
Usually because your number or email appears on lists from leaks or public sources, and possibly because an earlier reply or click marked it as active. It rarely means you were singled out.
Do scammers target people who have already been scammed?
Yes. Victims are often contacted again, especially by fake recovery services. Lists of past victims are traded among criminals.
What makes a business a target?
Regular payments to suppliers, public information about staff and roles, and email-based processes for changing bank details. Business email compromise and invoice fraud exploit exactly these.
Sources
- How To Avoid a Scam, US Federal Trade Commission
- Refund and Recovery Scams, US Federal Trade Commission
- Social media: how to use it safely, UK National Cyber Security Centre
